Run 001first execution
determinism envelope
- capability
- finance.npv
- runtime_bundle
- 0.1.0 · 4d64142e…
- platform
- darwin-arm64
- precision_mode
- float64
- thread_count
- 1
- value
- 505.020148896933
computation_hashb74f67d0d7a594aa…
Determinism, by construction
Deterministic AI,
by construction.
Ask a model the same question twice and you can get two answers. That is non-deterministic AI — fine for prose, fatal for numbers. SQAI takes the number away from the model: every computation runs on a pinned float64 runtime, single-threaded, and prints the hash that replays it exactly.
IIThe replay
Two certificates, months apart.
One computation — finance.npv at a 10% discount rate over five cash flows — executed once, then replayed months later. Determinism as a promise would ask for your trust. As a hash, it asks for a comparison.
Run 002months later
determinism envelope
- capability
- finance.npv
- runtime_bundle
- 0.1.0 · 4d64142e…
- platform
- darwin-arm64
- precision_mode
- float64
- thread_count
- 1
- value
- 505.020148896933
computation_hashb74f67d0d7a594aa…
Identical. Not similar — identical.
shared computation_hashb74f67d0d7a594aa7ac91f6291612452aa8ccdf603351ebc8d801a6fddd91bc8
Two languages, one byte stream
TypeScriptcanonicalJson(result.value)
Pythoncanonical_json(result.value)
identical bytes, either language505.020148896933
same bytes in → same sha256 out → the same certificate
canonicalJson in TypeScript and canonical_json in Python emit the same bytes by construction: −0 becomes 0, keys sort, unicode escaping is fixed. Hash equality across languages is not a coincidence to hope for — it is a serialization contract.
IIIThe fine print
Deterministic — within the declared scope.
“Deterministic” is easy to print and hard to honor. SQAI does not claim your result is identical across every machine in the universe. It declares an execution scope, records that scope in the envelope, and guarantees identity within it.
Recording the environment beats overclaiming it. Anything that could change the number is either pinned or written down.
declared on every resultdeterministic_scope: "local_registered_source"
- runtime_bundle_version
- the engine build that ran — 0.1.0 today, pinned
- runtime_bundle_sha256
- the build's content hash — verified before it ever executes
- platform
- where it ran — darwin-arm64 or linux-x64, recorded, never assumed
- architecture
- the CPU family, written down for the same reason
- precision_mode
- float64 — one numeric regime for every capability
- thread_count
- 1 — no scheduling races inside your arithmetic
- seed
- optional — demanded by exactly 10 simulation capabilities
- input_hash
- the data as it stood, stamped before execution
IVDomain-separated provenance
Three hashes, three questions.
Provenance here is not a log line. It is three sha256 constructions, each answering a different question, each computed over canonical bytes.
plan_hashf87610d8afeb…What will run.
The resolved plan, hashed before anything executes. The same question resolves to the same plan — decision_path: exact_spec — so a plan reviewed once is reviewed forever.
invocation_hashWhat was asked.
The identity of the call — the capability plus its canonicalized arguments — behind its own version-tagged prefix. explainQuery prints this as a dry-run preview; the executed hash is stamped independently at run time.
computation_hashb74f67d0d7a594aa…What came back.
Folds in the invocation_hash before the canonical bytes of the value. The answer is cryptographically chained to its question — this hash cannot be stapled onto a different result.
invocation_hash = sha256("sqai:invocation:v1\0" + canonicalJson(identity))
computation_hash = sha256("sqai:computation:v1\0" + invocation_hash + canonicalJson(value))The prefixes are the point. "sqai:invocation:v1" and "sqai:computation:v1" are disjoint universes of bytes: an invocation can never collide with a computation, and a future v2 can never impersonate v1. Domain separation makes the hashes evidence, not decoration.
Beneath all three, the surface itself is pinned. The capability contract that defines what can run at all ships with a hash of its own:contract_hash sha256:79f1c5a6c716…
Temperature 0
is not determinism.
sampling is not execution — the model never computes here
VSampling vs execution
The model picks tokens. The engine computes.
temperature: 0a decoding setting
- Greedy decoding narrows which token comes next. The number is still predicted, not computed.
- The same question can still become different SQL — and a different answer — with nothing to flag it.
- Nothing is recorded: no runtime, no input hash, nothing to replay.
computation_hashan execution property
- The model files a typed plan. The engine executes it — float64, one thread, pinned bundle.
- The environment travels with the result, inside the determinism envelope.
- Every answer prints a computation_hash. Replay is a comparison, not an argument.
0/16 → 16/16
the same model on sixteen quantitative questions — before and after the engine does the computingThe engine itself is audited: 2,744 correctness checks, 0 mismatches, max numeric error 1.8e-15.
VIWhere determinism could break
Ten seeds. One tripwire.
seed_required
Ten of the 4,574 exposed capabilities simulate randomness. Unseeded, they do not run at all — the call is rejected before execution. Seeded, they replay like everything else. No hidden entropy, no quiet exceptions.
one of the tendistributions.sample_normal
schema_revision_mismatch
Every registered source carries a schema revision. Replay a plan against data that has changed and the engine refuses with a structured error — not a silently different number that nothing would ever flag.
declared on every sourceschema_revision
4,564 deterministic as-is · 10 deterministic once seeded · 0 that guess
VIIQuestions
Deterministic AI, asked plainly.
What is deterministic AI?
A system whose answers reproduce exactly: same input, same output, provably. SQAI implements it by construction — computations execute on a pinned float64 runtime, single-threaded, and every result carries a computation_hash that replays it byte-identically.
What is non-deterministic AI?
A system whose output can vary across identical requests. Language models sample tokens, so the same question can produce different reasoning, different SQL, and different numbers — with no signal that anything changed. A replayable hash is the antidote to that drift.
Doesn't temperature 0 make an LLM deterministic?
Temperature only narrows how the next token is chosen. The model is still predicting your number rather than computing it, and nothing about the run is recorded or replayable. SQAI's determinism is a property of execution, not decoding: the model files a typed plan and the engine does the arithmetic.
How do I verify that two runs really returned the same answer?
Compare the computation_hash on each result. It is a domain-separated sha256 over the invocation identity and the canonical bytes of the value, so matching hashes mean byte-identical answers — the finance.npv example prints b74f67d0… in both TypeScript and Python.
How can simulations be deterministic?
By refusing to be random in secret. Exactly 10 of SQAI's 4,574 exposed capabilities simulate randomness; called without a seed they are rejected with seed_required, and with a seed they replay exactly like every other capability.
What if the data changed between the first run and the replay?
The replay fails loudly. Every registered source carries a schema revision, and a plan replayed against changed data returns schema_revision_mismatch — a structured error, never a silently different number.